Vulnerability Note VU#345233

McAfee Virex fails to properly authenticate the source of updates

Overview

McAfee Virex automatic updates may not properly authenticate the source of updates. This may allow a remote attacker to execute arbitrary commands on a vulnerable system.

I. Description

McAfee Virex is anti-virus software for the Mac OS X platform. McAfee Virex 7 for Mac OS X connects to a remote FTP server to retrieve updates. However, Virex fails to properly authenticate the server or the contents of the retrieved updates. This may allow a remote attacker to spoof the update server and its contents, allowing that attacker to download and execute arbitrary commands on a Virex client system.

II. Impact

A remote attacker can execute arbitrary commands.

III. Solution

Apply a patch from McAfee Virex

A patch to address this issue is available by visiting the McAfee SecurityCenter and clicking the update button.

Systems Affected

Vendor	Status	Date Notified	Date Updated
McAfee	Vulnerable	28-Aug-2006

References

http://prisms.cs.umass.edu/~kevinfu/papers/secureupdates-hotsec06.pdf

Credit

Thanks to Anthony Bellissimo, John Burgess, and Kevin Fu for reporting this vulnerability.

This document was written by Jeff Gennari.

Other Information

Date Public:	2006-07-31
Date First Published:	2007-02-15
Date Last Updated:	2007-02-16
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Metric:	0.11
Document Revision:	27

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Produced 2007 by US-CERT, a government organization
Disclaimers and copyright information

Get Adobe Reader